Source-linked AI summary
One-Class Adversarial Nets for Fraud Detection
Panpan Zheng, Shuhan Yuan, Xintao Wu, Jun Li, Aidong Lu
TL;DR
Fraud detection often lacks sufficient malicious-user records for training. OCAN learns benign activity representations with an LSTM-Autoencoder and uses a complementary GAN discriminator for one-class detection. It outperforms state-of-the-art one-class classifiers and achieves comparable performance with an M-LSTM model trained using benign and malicious users.
Problem
Many fraud-detection approaches require benign and malicious training records, although malicious-user data are often unavailable or scarce.
Method
OCAN learns benign user representations from activity sequences with an LSTM-Autoencoder and trains a complementary GAN discriminator for detection.
Results
OCAN outperforms state-of-the-art one-class classification models and achieves comparable performance with the latest M-LSTM model requiring benign and vandal users during training.
Takeaways & Limitations
OCAN supports fraud detection when only benign users are observed and can perform early vandal detection from user edit sequences.
Abstract
from arXiv · showhide
Many online applications, such as online social networks or knowledge bases, are often attacked by malicious users who commit different types of actions such as vandalism on Wikipedia or fraudulent reviews on eBay. Currently, most of the fraud detection approaches require a training dataset that contains records of both benign and malicious users. However, in practice, there are often no or very few records of malicious users. In this paper, we develop one-class adversarial nets (OCAN) for fraud detection using training data with only benign users. OCAN first uses LSTM-Autoencoder to learn the representations of benign users from their sequences of online activities. It then detects malicious users by training a discriminator with a complementary GAN model that is different from the regular GAN model. Experimental results show that our OCAN outperforms the state-of-the-art one-class classification models and achieves comparable performance with the latest multi-source LSTM model that requires both benign and malicious users in the training phase.
1 INTRODUCTION
Online platforms face malicious users and fraudulent actions, while many detection models require malicious-user records that are often unavailable. OCAN addresses this setting by learning benign representations and using a complementary adversarial discriminator to detect malicious users dynamically.
- Online platforms face malicious users who spread spam, rumors, vandalism, fake content, and other fraudulent actions.
- Existing detection models commonly require training data containing both benign and malicious users, but malicious records are often scarce and costly to label.
- OCAN learns benign-user representations from activity sequences with an LSTM-Autoencoder, then trains a complementary GAN discriminator to distinguish benign users from potential malicious users.
- OCAN generates complementary samples of benign users and trains the discriminator to separate them from real benign users, supporting malicious-user detection without malicious-user information.
- The trained model adaptively updates user representations after new actions and predicts fraud dynamically.
2 RELATED WORK
Prior fraud-detection research uses content, graph, behavioral, and deep-learning approaches, but many methods depend on malicious examples or labeled thresholds. The paper positions OCAN as a one-class deep-learning framework using only benign users.
- Fraud-detection research includes content-based methods using text or URLs and graph-based methods using network topologies.
- Related work addresses vandalism, rumors, fake reviews, review spammers, suspicious users, and fraudsters who mimic normal behavior.
- Traditional one-class methods such as OCNN and OCGP require thresholds set by experts or tuned with small two-class labeled datasets.
- OCAN combines an LSTM-Autoencoder and GAN to detect vandals using only benign training data and without labeled data for parameter tuning.
3 PRELIMINARY
LSTM represents sequential activity through recurrent hidden states, while GANs use a generator and discriminator in an adversarial objective. Together, these preliminaries establish sequence modeling and synthetic-sample discrimination.
- Long short-term memory network: An LSTM processes an input sequence while maintaining hidden states that capture information from current and previous inputs.
- Long short-term memory network: The LSTM update uses gates, cell states, weight parameters, biases, sigmoid operations, and element-wise products.
- Long short-term memory network: Each simplified LSTM step maps the current input and previous hidden vector to the current hidden output.
- Generative adversarial nets: A GAN contains a generator that produces samples from noise and a discriminator that classifies inputs as real or generated.
- Generative adversarial nets: The discriminator objective rewards high scores for real data and low scores for generated data.
- Generative adversarial nets: GAN training is formalized as a minimax game in which the generator seeks to fool the discriminator and theoretical analysis links training to Jensen-Shannon divergence minimization.
4 OCAN: ONE-CLASS ADVERSARIAL NETS
OCAN learns benign-user representations with an LSTM-Autoencoder, then trains a complementary GAN whose generator targets low-density regions of benign users. The resulting discriminator is designed to distinguish benign users from complementary samples that support malicious-user detection.
- LSTM-Autoencoder for User Representation: OCAN first trains an LSTM-Autoencoder on benign activity sequences and uses its encoder to produce fixed-dimension user representations.The autoencoder reconstructs activity sequences so the final encoder hidden vector captures salient user-behavior information.
- Complementary GAN: The complementary GAN generates samples in low-density regions of the benign-user representation space rather than imitating benign users.Its generator learns a distribution close to the complementary distribution and constrains generated samples to the user-representation space.
- Complementary GAN: The discriminator is trained to separate benign representations from complementary samples, enabling detection of malicious users located in separate regions.This design contrasts with regular GAN training, whose generated fake benign users occupy regions similar to real benign users.
- Training Procedure: OCAN training proceeds in two phases: autoencoder training and representation extraction, followed by complementary-GAN training.The algorithm takes a benign-user activity dataset as input and returns a trained LSTM-Autoencoder and complementary GAN.
- Complementary GAN: The generator output has the same dimension as the user representation, and its objective combines complementary-distribution matching with feature matching.The complementary generator is implemented as a feedforward neural network and minimizes divergence-related and feature-matching objectives.
5 FRAUD DETECTION MODEL
During fraud detection, OCAN encodes a user’s activity sequence into a representation and applies the complementary-GAN discriminator to predict the user label. Because representations update as new actions arrive, the model also supports early, dynamic detection.
- Fraud Detection Model: OCAN computes a user representation with the LSTM-Autoencoder encoder and predicts the user label with the complementary-GAN discriminator.The detection pipeline uses p(ŷ_u|v_u) = D(v_u).
- Early Fraud Detection: At each activity step, OCAN updates the hidden state and uses the current representation to estimate whether the user is malicious.This enables early detection before the full activity sequence is complete.
6 EXPERIMENTS
Experiments evaluate OCAN on Wikipedia vandal detection, early detection, framework behavior, and credit-card fraud. Across these settings, OCAN generally outperforms one-class baselines, matches M-LSTM when malicious training data are abundant, and benefits from complementary samples and learned representations.
- Experimental setup: The Wikipedia evaluation uses 7000 benign users for training and 3000 benign users plus 3000 vandals for testing, with edit sequences restricted to lengths of 4–50.The underlying dataset contains 10,528 benign users and 11,495 vandals after preprocessing.
- Comparison with one-class classification: OCAN achieves better F1 score and accuracy than one-class baselines, while LSTM-Autoencoder representations improve baseline performance over raw features.OCAN has higher standard deviations than representation-based baselines, reflecting comparatively lower training stability.
- Comparison with one-class classification: OCAN outperforms OCAN-r, indicating that training the discriminator on real and complementary samples more accurately separates benign users from vandals.OCAN-r replaces the complementary GAN with a regular GAN.
- Early vandal detection: OCAN achieves comparable early-vandal-detection performance to M-LSTM when M-LSTM uses 1000, 4000, or 7000 vandals, while requiring no vandals during training.M-LSTM fails to detect any vandal when trained with fewer than 400 vandals.
- OCAN framework analysis: OCAN is more stable and converges faster than OCAN-r: OCAN converges after 20 epochs, whereas OCAN-r requires nearly 100 epochs to remain stable.OCAN-r's F1 score is less stable and slightly lower because regular-GAN discriminator outputs approach 0.5.
- OCAN framework analysis: Complementary samples occupy low-density regions between benign users and vandals, supporting separation because the discriminator is trained to distinguish benign from complementary benign users.The real-benign and complementary-benign centroids are 3.6346 apart, compared with 3.888 between real-benign and vandal centroids.
- Credit-card fraud detection: On credit-card fraud detection, OCAN achieves the best accuracy and F1 with both raw features and transaction representations, and representations outperform raw features.The results support application across different datasets and malicious-user types.
- Credit-card fraud detection: On an imbalanced dataset containing 1000 genuine and 100 fraudulent transactions, OCAN shows promising fraud-detection performance with both input types.The model is trained on 700 genuine transactions before testing.
7 CONCLUSION
OCAN combines LSTM-Autoencoder representations with a complementary GAN for fraud detection when training data contains only benign users. Experiments show that it outperforms state-of-the-art one-class models and achieves comparable accuracy to M-LSTM while supporting early vandal detection.
- OCAN combines LSTM-Autoencoder representations with a complementary GAN for fraud detection using only benign users during training.The model first learns benign user representations from online activities, then trains a complementary GAN on those representations.
- OCAN outperforms state-of-the-art one-class classification models on two real-world datasets.
- OCAN achieves early vandal detection by taking user edit sequences as inputs.
- OCAN achieves comparable accuracy with the latest M-LSTM model, which requires benign and vandal users during training.